About UmutAK

Hello everyone,   We have a mirroring problem within 1 tenannt and 1 soar host/server. Both of them are in the same network/side. Some how we can search incidents from tennant to soar host, however while using mirroring integration in order to provide incident in a continous way they cannot be can not be fetched.   To examplify:    soar host/server has incidents in range 1-100 (id) our soar tenant can get in 1-15 (id)   We ve tried and worked on integration parameters however didnt work as well. As far as we are concerned fetching issue has some kind of bug in there.   ... View more

I wanted to block ips via using xsoar, on Pan-os panorama. We have integrated xsoar and panoroma but non of the automations provide us a blocking on panorama. In addition to that I tried to give inputs to Block IP Generic v3 playbook(which is provided by palo alto). Our aim is blocking IP **WITHOUT** using edl or static list, which corresponds DAG(dynamic address group) section of your playbook. However we can not see any blocking operations on prisma or any sort of firewall. To sum up, I want to block ips just using panoroma xsoar integration by using Dynamic Address Group. Whenever we are checking ips from panoroma I can only see that xsoar alters corresponding address group but can not add any ip to block. ... View more

Hello all,   To handle with different types of playbooks and tasks, is there any implementation method or best practice guide to identify errors in playbooks. If a task or subplaybook stucks in main playbook I want to get informed about it and handle with it. If you have any sort of guide or advice I am open to hear it.   Best regards ... View more

Dear all,   We have an issue about visulazating the outputs of indicator enrichment via using virus total ( vt-passive-dns-data).   To be more specific I am going to share our indicator layout and what we are expecting. As its given in the first screenshot we are using nearly default indicator layout.   However to provide more precise information to analyst team we want to illustratre passive dns records ( which is under Virus Total's relations tab) via command : !vt-passive-dns-data ip=8.8.8.8   Command execution in CLI provides a table output as its given in the screen shot.    Main question is that, is it possible to add automation's result/output to the indicator layout for which data taken from an incident               ... View more

Hi all,   I wonder that if it is possible to show context data directly on layout, without mapping that data to incident field. ... View more